Executive brief
Nimiq is a blockchain protocol that uses a distributed network to store and retrieve data. A flaw in how the software handles responses from other participants allows a malicious or malfunctioning peer to send invalid data that causes the Nimiq node to hang indefinitely. This can lead to a denial-of-service condition where the node stops responding to data requests, potentially disrupting blockchain operations and network synchronization.
Technical details
A vulnerability exists in the `handle_dht_get` function within `network-libp2p/src/swarm.rs` of the Nimiq Rust implementation. When a peer returns a `FoundRecord`, the system performs a verification check; if this check fails, the code returns early without completing the internal 'oneshot' channel or cleaning up query bookkeeping. Because the `Network::dht_get` function awaits this channel without a timeout, the calling future remains in a permanent pending state (a 'wedge'). An attacker can exploit this by providing malformed or invalid DHT records, leading to resource exhaustion or service unavailability. This issue is addressed in version 1.4.0 by introducing proper error variants and an `abort_dht_get()` function to ensure state cleanup.
Affected products
- Nimiq core-rs-albatross <= 1.3.0
Timeline
- 2026-04-22: patched: Fix merged in pull request #3716 and released in v1.4.0
- 2026-05-15: advisory: GitHub Security Advisory GHSA-g39c-jcgg-qwvr published
- 2026-06-10: disclosed: CVE-2026-44505 published to NVD